(ensp)华为USG6000v防火墙双机热备份的配置

PC1进行配置IP：

PC2进行配置IP：

防火墙FW1
接口进行配置IP：

interface GigabitEthernet1/0/0
ip address 192.168.1.2 255.255.255.0
service-manage ping permit
quit
interface GigabitEthernet1/0/1
ip address 192.168.3.1 255.255.255.0
service-manage ping permit
quit
interface GigabitEthernet1/0/2
ip address 192.168.2.2 255.255.255.0
service-manage ping permit
quit

接口分配区域

firewall zone trust
add interface GigabitEthernet1/0/0
quit
firewall zone untrust
add interface GigabitEthernet1/0/2
quit

新建一个区域heartbeat存放心跳线的口

firewall zone name heartbeat id 4
set priority 80
add interface GigabitEthernet1/0/1
quit

防火墙FW2
接口进行配置IP：

interface GigabitEthernet1/0/0
ip address 192.168.1.3 255.255.255.0
service-manage ping permit
quit
interface GigabitEthernet1/0/1
ip address 192.168.3.2 255.255.255.0
service-manage ping permit
quit
interface GigabitEthernet1/0/2
ip address 192.168.2.3 255.255.255.0
service-manage ping permit
quit

接口分配区域

firewall zone trust
add interface GigabitEthernet1/0/0
quit
firewall zone untrust
add interface GigabitEthernet1/0/2
quit

新建一个区域heartbeat存放心跳线的口

firewall zone name heartbeat id 4
set priority 80
add interface GigabitEthernet1/0/1
quit

至此，基础配置完成
FW1（主设备）进行配置VRRP：

interface GigabitEthernet1/0/0
vrrp vrid 1 virtual-ip 192.168.1.254 active
quit

另一个VRRP的配置：

interface GigabitEthernet1/0/2
vrrp vrid 2 virtual-ip 192.168.2.254 active
quit

FW2（备用设备）进行配置VRRP：

interface GigabitEthernet1/0/0
vrrp vrid 1 virtual-ip 192.168.1.254 standby
quit

另一个VRRP的配置：

interface GigabitEthernet1/0/2
vrrp vrid 2 virtual-ip 192.168.2.254 standby
quit

VRRP配置完成。配置心跳口

FW1: hrp interface GigabitEthernet1/0/1 remote 192.168.3.2
FW2: hrp interface GigabitEthernet1/0/1 remote 192.168.3.1

两台设备都开启HRP：

hrp enable
hrp auto-sync

然后进行配置安全策略：关闭CLI之后再进入FW1，直接在FW1配置安全策略即可，命令后面的（+B）即表示会同步到备用设备上

security-policy
rule name ping
source-address 192.168.1.0 0.0.0.255
destination-address 192.168.2.0 0.0.0.255
service icmp
action permit
quit

所有配置完成。进行验证

关掉主设备（FW1）的一个口，再进行验证

HRP_M[FW1]interface GigabitEthernet 1/0/0  (+B)  # 这个关闭端口的命令不会同步到备用设备，可以放心使用
HRP_M[FW1-GigabitEthernet1/0/0]shutdown
HRP_M[FW1-GigabitEthernet1/0/0]quit

再进行验证